Getting Data In

Error when routing data to index and sourcetype based upon incoming hosts: "Undocumented key used in transforms.conf"

Champion

Hi,

I'm trying to route data to different indexes and sourcetypes based upon hosts coming, but getting errors, and uncertain why. The errors are:

Undocumented key used in transforms.conf; stanza='ise2_index_override' setting='DEST_KEY' key='MetaData:Index'
Undocumented key used in transforms.conf; stanza='ise_index_override' setting='DEST_KEY' key='MetaData:Index'
Undocumented key used in transforms.conf; stanza='pep_index_override' setting='DEST_KEY' key='MetaData:Index'
Undocumented key used in transforms.conf; stanza='pf_index_override' setting='DEST_KEY' key='MetaData:Index'

Inputs (udp feed)
[udp://10515]
connection_host = dns
index = main
sourcetype = temp10515_syslog

Props.conf:
[temp10515_syslog]
ANNOTATE_PUNCT = false
KV_MODE = AUTO
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRANSFORM-10515sourcetype_and_index_override = ise2_index_override, ise2_sourcetype_override, pf_index_override, pf_sourcetype_override

Transforms.conf:
[ise2_sourcetype_override]
DEST_KEY = MetaData:Sourcetype
REGEX = (%ISE)
FORMAT = sourcetype::cisco:ise:syslog

[ise2_index_override]
DEST_KEY = MetaData:Index
REGEX = (%ISE)
FORMAT = network90

[pf_sourcetype_override]
DEST_KEY = MetaData:Sourcetype
REGEX = (%PF)
FORMAT = sourcetype::netscreen_syslog

[pf_index_override]
DEST_KEY = MetaData:Index
REGEX = (%PF)
FORMAT = network
0 Karma

DEST_KEY for index should be

_MetaData:Index : The index where the event should be stored. (Notice the underscore prefix)

(http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Transformsconf)

Esteemed Legend

Yes, this one is special.

0 Karma

Ultra Champion

@damien_chillet FTW! Accept this answer @a212830 and make it rain karma!

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!